A Machine Learning Approach to Fab-of-Origin Attestation

Ali AhmadiDept. of Electrical Engineering

The University of Texas at DallasRichardson, TX 75080

Mohammad-Mahdi BidmeshkiDept. of Electrical Engineering

The University of Texas at DallasRichardson, TX 75080

Amit NaharTexas Instruments Inc.

12500 TI Boulevard, MS 8741Dallas, TX 75243

Bob OrrTexas Instruments Inc.

12500 TI Boulevard, MS 8741Dallas, TX 75243

Michael PasTexas Instruments Inc.

12500 TI Boulevard, MS 8741Dallas, TX 75243

Yiorgos MakrisDept. of Electrical Engineering

The University of Texas at DallasRichardson, TX 75080

ABSTRACTWe introduce a machine learning approach for distinguish-ing between integrated circuits fabricated in a ratified fa-cility and circuits originating from an unknown or unde-sired source based on parametric measurements. Unlikeearlier approaches, which seek to achieve the same objec-tive in a general, design-independent manner, the proposedmethod leverages the interaction between the idiosyncrasiesof the fabrication facility and a specific design, in order tocreate a customized fab-of-origin membership test for thecircuit in question. Effectiveness of the proposed methodis demonstrated using two large industrial datasets from a65nm Texas Instruments RF transceiver manufactured intwo different fabrication facilities.

1. INTRODUCTIONAs the semiconductor industry has largely adopted the

fab-less paradigm and as globalization has amplified con-cerns regarding integrity of the electronics supply chain, theability to definitively identify the fabrication facility whereinan integrated circuit (IC) was manufactured has become im-perative. Such a fab-of-origin attestation ability could con-stitute the cornerstone for numerous applications in the elec-tronics industry, including intellectual property (IP) protec-tion, licensing enforcement, quality and hardware integrityassurance, supply chain risk management, counterfeit IC de-tection and failure analysis, among others.

The importance of fab-of-origin attestation is highlightedby a recent US government research initiative whose ob-jective is to devise methodologies which use measurable elec-tronic or physical characteristics for determining the specificfabrication facility of origin of a given electronic component[4]. The various methods developed under this initiative seekto leverage the specifics of a manufacturing process, suchas the use of particular materials or geometric rules during

Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full cita-tion on the first page. Copyrights for components of this work owned by others thanACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-publish, to post on servers or to redistribute to lists, requires prior specific permissionand/or a fee. Request permissions from permissions@acm.org.

ICCAD ’16 November 07-10, 2016, Austin, TX, USAc© 2016 ACM. ISBN 978-1-4503-4466-1/16/11. . . $15.00

DOI: http://dx.doi.org/10.1145/2966986.2966992

fabrication, in order to identify the fab-of-origin. Utilizingon-die laser markings during fabrication, atomic force mi-croscopy (AFT), nanoscale structural, mechanical and elec-trical characterization based on transmission electron mi-croscopy, device characterization, and using features of spec-troscopic chemical signals from electronic components foridentifying the source fab are among the explored directions[4]. All of these approaches, however, require additionalcomplicated steps during manufacturing or specialized andexpensive equipment during characterization in order to per-form fab-of-origin attestation. An earlier approach to ad-dress this problem was introduced in [3], where the authorsproposed a methodology to etch forensic information regard-ing the fabrication process on the die, or add memory ele-ments to electrically store such data. While recovering thisinformation can reveal the fabrication facility, this approachalso incurs additional processing and characterization over-head and introduces the need for measures to ensure thatthe forensic information has not been tampered with.

Along a different direction, a methodology which lever-ages intrinsic variation of the semiconductor manufacturingprocess for foundry identification purposes was introducedin [16]. Process variation has been successfully exploitedin various other tasks, including IC identification throughphysical unclonable functions (PUFs) [7, 11], hardware Tro-jan detection [2, 13], as well as counterfeit IC detection [5,8]. The authors of [16], however, were the first to demon-strate its utility in this context. Specifically, they intro-duced a methodology for reverse engineering process param-eters, such as threshold voltages and effective channel lengthof CMOS devices, using gate delay measurements obtainedthrough an elegant path decomposition formulation. Statis-tical tests comparing the distribution of these parameters tothe profiles of known foundries may, then, be used to iden-tify which foundry fabricated the IC in question. While thismethod is design-independent, it requires access to the gatelevel implementation of the fabricated IC in order to reverseengineer these process parameters, which may pose an ob-stacle due to IP protection issues. Moreover, as explainedin [16], reverse engineering of these parameters can becomequite complicated in practice. Nevertheless, leveraging in-trinsic process variation and simple electronic measurementsfor the purpose of fab-of-origin attestation is very appealing,as it does not require specialized process or characterizationefforts and can be readily applied to existing ICs.

In contrast to the aforementioned design-independent ap-proaches to fab-of-origin attestation, in this paper we intro-duce a machine learning approach which leverages the in-teraction between the idiosyncrasies of a fabrication facilityand a particular design. Specifically, we develop solutions forfour variants of the fab-of-origin attestation problem. Thefirst two variants assume availability of the test data profilefrom the ratified fabrication facility only, and seek to attestwhether a single chip or a batch of chips, respectively, hasbeen fabricated therein or not. The other two variants as-sume availability of the test data profile from all facilitieswhich fabricate this chip and seek to identify whether a sin-gle chip or a batch of chips, respectively, were fabricated inthe ratified fab or not. The proposed solutions rely only onthe typical parametric test measurements1 of a fabricatedIC and require neither knowledge of the design, nor any ad-ditional provisions during manufacturing or any specializedmeasurement equipment.

Effectiveness of the proposed solutions is demonstratedusing two large industrial datasets from a 65nm Texas In-struments RF transceiver produced in two geographicallydispersed fabrication facilities. Considering that alternatefabrication facilities within the same company are highlytuned to resemble each other as much as possible, we pointout that our evaluation is performed not only using realisticdatasets but also ones that are very hard to tell apart.

The rest of this paper is organized as follows. In Section2, we briefly define the four variants of the fab-of-origin at-testation problem which we address herein. In Section 3, wedescribe the proposed solutions. In Section 4, we experimen-tally assess the accuracy of these solutions and, in Section5, we draw conclusions.

2. PROBLEM DEFINITIONThe methods proposed in this work seek to identify whether

an IC was manufactured in a ratified fabrication facilitybased solely on the parametric measurements obtained dur-ing post-manufacturing testing. We note that these mea-surements have predefined acceptable ranges; any IC whosevalues fall outside these ranges is considered faulty and isdiscarded. Hence, what we are seeking is the ability to dis-tinguish between the footprints of healthy chips from theratified fab and the footprints of healthy chips from otherfabs within the hyper-dimensional parametric space of ac-ceptable performances. The conjecture here is that, for thesame design and process, certain idiosyncrasies stemmingfrom manufacturing tool installations, chemical sources, aswell as altitude and geomagnetic location of the fabricationfacility, lead to minor, yet systematic disparities in the re-sulting products of different fabs. These disparities may,therefore, be leveraged through machine learning methodsin order to attest the source of origin of a given IC [4].

Four variants of the fab-of-origin attestation problem areconsidered herein:

• AttestMe-I: In this variant of the fab-of-origin attesta-tion problem we assume that the only data to which wehave access is the parametric test data profile from a sta-tistically significant number of chips manufactured in theratified fab. Given this profile and the parametric tests of

1While in this work we only consider probe-test data, shouldon-die process control measurement (PCM) data be avail-able, they can be seamlessly integrated into our solutions.

a single IC, we seek to decide whether it was manufacturedin the ratified fab or not.

• AttestUs-I: This variant assumes availability of the sameinformation as above; instead of making a decision for asingle IC, however, it considers the parametric tests of anentire batch of ICs and seeks to make a collective decisionfor the batch, assuming that they were all manufacturedin the same fabrication facility.

• AttestMe-II: In this variant, we assume availability ofthe parametric test data profile from a statistically signif-icant number of chips manufactured in each of the fabswherein a given design could have been produced. Giventhese profiles and the parametric tests of a single IC, weseek to decide whether it was produced by the ratified fabor any other fab.

• AttestUs-II: Using the same information as above, thisvariant seeks to decide whether an entire batch of ICs,originating from the same facility, was manufactured inthe ratified fab or any other fab.

We note that the Attest(Me/Us)-I variants require lesstraining data, since they only rely on the profile of theratified fab, as opposed to all fabs, yet are more difficultthan their Attest(Me/Us)-II counterparts. Similarly, theAttestMe-(I/II) variants require less test data, since theymake decisions for individual ICs, as opposed to batches ofICs, yet are more difficult than their AttestUs-(I/II) coun-terparts.

3. PROPOSED SOLUTIONSIn this section, we present the proposed solutions for the

four variants of the fab-of-origin attestation problem, whichwe introduced in Section 2.

3.1 AttestMe-IThe AttestMe-I variant is, essentially, a one-class classi-

fication problem, for which numerous solutions exist in theliterature [10]. Specifically, given a statistically significantset of parametric test data from the ratified fab, we needto learn a boundary that encloses this population in themultidimensional space of these measurements. The trainedone-class classifier then compares the footprint of a new ICto this boundary, in order to decide whether it came fromthe ratified fabrication facility or not.

The key challenge in the context of AttestMe-I, however,is the high dimensionality of our data, which is typically inthe few hundreds (i.e., number of probe-tests). Indeed, dueto the curse of dimensionality, it is practically impossibleto capture the underlying interaction between the designand the idiosyncrasies of a specific fab and to establish anymeaningful boundary in the raw data space. Instead, theproposed method employs the following steps:

Dimensionality Reduction: In order to reduce the di-mensionality of the test data, we employ the t-DistributedStochastic Neighbor Embedding (t-SNE) [15] technique.t-SNE is a non-linear transformation of the parametric testdata into a lower-dimensional feature space, wherein enoughdiscriminative power exists for learning the boundary thatencloses the population.

Clustering: Once the data is projected in the trans-formed space, we use the GAP statistic method [14] to es-timate the number of clusters that the data consists of, fol-

lowed by k-means clustering to separate the data into thecorresponding number of clusters.

Boundary Identification: A simple one-class classi-fier (i.e., a convex hull) is then trained to enclose the dataof each cluster. Collectively, the acceptance region of thetrained one-class classifiers for all the clusters, define thespace where ICs from the ratified fab are expected to reside.

Decision Making: Given the test data of a new IC, itsfootprint in the transformed space is computed and com-pared to the acceptance region. The IC is considered asoriginating from the ratified fab if and only if this footprintfalls within any of the learned clusters.

We note that we considered the simpler and very pop-ular Principal Component Analysis (PCA) [9] method fordimensionality reduction. However, as we will demonstratein Section 4.1, the variance of our data appears to be highlynon-linear; therefore, PCA, which linearly transforms theoriginal data to a lower dimensional subspace, while retain-ing most of its variance, performs poorly. We also note thatwe considered training an advanced one-class classifier (i.e.,SVM) to directly learn a single boundary in the reduced fea-ture space. However, the data in this space is highly discon-tinuous, with the vast majority of the points congregatingin small clusters. Therefore, as we will demonstrate in Sec-tion 4.1, learning a single boundary to successfully includeall these discontinuous regions while excluding the rest ofthe space is of limited effectiveness.

3.2 AttestUs-IOur solution to the AttestUs-I variant seeks to take ad-

vantage of the fact that process variations are expected toaffect ICs produced within the same fab in a correlated way.Accordingly, this correlation can be leveraged to improvefab-of-origin attestation effectiveness for a batch of ICs, allof which originate from the same fab. To achieve this, we as-sess the underlying distribution of performance parametersfor this batch against the profile of the ratified fab using anon-parametric statistical test. In particular, we employ theAnderson-Darling (AD) test [1], which is a well-known pro-cedure for determining whether a sample of k observationscomes from a given distribution or not. Its main advantagesinclude its sensitivity to the distribution shape and its ap-plicability to small sample sizes. In order to utilize the ADtest in the fab-of-origin attestation context, we apply thefollowing procedure:

Density Estimation: For every performance parame-ter t of the device under attestation, we use the paramet-ric measurements in the statistically significant training setfrom the ratified fab, along with Kernel Density Estimation(KDE) [12] using Epanechnikov kernel, in order to computeits probability density function, PDFt.

Membership Test: Consider mt as the measurementvector of performance parameter t from all ICs in the batchunder attestation. We apply the AD test to the estimateddensity and the measurements from the chips in the batch,i.e., AD(PDFt,mt), where the null hypothesis is that themeasurement vector, mt, comes from the estimated densityof the ratified fab. The output of the AD test is an asymp-totic p-value in the range 0 to 1. For a p-value less thana chosen threshold (usually 0.05), the null hypothesis is re-jected and we deduce that the distribution of the measureddata, mt, is dissimilar to the estimated density (i.e., thisbatch of chips does not originate from the ratified fab).

Decision Making: This procedure is repeated individ-ually for each performance parameter. A majority vote is,then, employed to provide the final decision for the batch.

3.3 AttestMe-IIThe AttestMe-II variant of attesting an individual chip,

when parametric measurements from a statistically signifi-cant number of chips from both the ratified and all other(i.e., undesired) fabs are available, boils down to a two-classclassification problem. Availability of populations from bothclasses simplifies the problem drastically and eliminates theneed for clustering. Instead, our solution to this variantinvolves the following steps:

Classifier Training: We use the available training datato train Deep Neural Networks (DNNs), which have recentlyachieved state-of-the-art performance in a wide range of clas-sification tasks of high dimensionality [6]. For our two-classclassification problem, a five-layer DNN with two outputneurons is trained using measurement data from both theratified and the undesired fabs. To train the entire network,a generative pre-training step is applied to train one layerat a time. Then, the whole network is fine-tunned using theback-propagation learning algorithm. Note that dimension-ality reduction is intrinsic to the DNN, and a separate stepis not required in this approach.

Decision Making: Given a new IC whose source of ori-gin needs to be attested, its performance parameters aremeasured and provided to the trained DNN, which deter-mines which of the two classes the IC belongs to, i.e., whetherit was produced in the ratified fab or in an undesired fab.

3.4 AttestUs-IIOur solution to the AttestUs-II variant follows the general

principles of what we described in Section 3.2 and consistsof the following steps:

Density Estimation: For every performance parameterof the IC batch under attestation, we compute its proba-bility density function (PDF) in both the ratified fab andthe undesired fab(s) by applying KDE on the correspondingtraining sets.

Membership Test: For every performance parameter,we apply the AD test using the measurement vector fromall ICs in the batch under attestation and the PDFs of theratified fab and the undesired fab(s). The combination ofthe two p-values determines whether, with respect to thisperformance parameter, the ICs in the batch were manufac-tured in the ratified fab or in an undesired fab.

Decision Making: This procedure is repeated individ-ually for each performance parameter. A majority vote is,then, employed to provide the final decision for the batch.

4. EXPERIMENTAL RESULTSIn this section, we experimentally evaluate the effective-

ness of the proposed solutions using actual production testdata from a 65nm RF transceiver currently in high volumemanufacturing (HVM) by Texas Instruments.

Our dataset comprises devices from two geographicallydispersed fabs wherein this RF transceiver is fabricated. Forthe purpose of this study, we consider one of these facili-ties as the ratified fab and the other one as the unknownor undesired fab. The dataset for the ratified fab includes600 wafers from 20 lots, with approximately 1500 die perwafer. For each die, 276 probe-test measurements are pro-

vided. These tests are the typical measurements performedat wafer probe to ensure compliance of the performances ofan RF transceiver design to its specifications (i.e., produc-tion tests). They include both structural tests (open/shortcircuit, power consumption, IDDQ, input voltage threshold,output voltage level, etc.) and functional tests (BER, EVM,CMMR, receiver sensitivity, output power, phase noise, etc.)and indirectly cover a broad range of process parameters.We note that we chose not to use in-line tests (e-tests) whichdirectly reflect process parameters, since they are on thewafer scribe-lines rather than the die, hence they are notavailable at the final chip level. The dataset of the unde-sired fab includes the same 276 probe-test measurementsfrom 500 wafers in 20 lots. These two datasets were ob-tained from the two fabs at approximately the same period.Using this dataset, we seek to:

• Visualize the overlap of the two populations in the rawdata space and in the linearly transformed PCA space,as well as the effectiveness of the non-linear t-SNE trans-formation in increasing discrimination, and demonstratethe limited effectiveness of training a one-class classifier(i.e., SVM) to separate the populations through a singleboundary, due to data discontinuity.

• Quantify the effectiveness of AttestMe-I and AttestUs-I,which use data solely from the ratified fab for learning theunderlying model, in distinguishing between ICs producedin the ratified and in an unknown fab.

• Assess the attestation accuracy improvement achieved byAttestMe-II and AttestUs-II, which are trained withdatasets from both the ratified and the undesired fabs.

• Demonstrate the effectiveness of our solutions in handlingprocess variations by assessing attestation accuracy on ICsfrom future production.

4.1 Population overlapTo demonstrate population overlap, we randomly select

5 wafers from each of the 20 lots in the ratified fab andwe use all probe-test data of all die on these 100 wafersas our training set. We, then, train a one-class SVM tolearn the boundary that encloses the population originatingfrom the ratified fab in three different spaces: (i) in theraw data space which includes all 276 dimensions, (ii) in aPCA transformed space where the data is linearly projectedon the first 30 principal components, and (iii) in the t-SNEtransformed space where the retained data is non-linearlyprojected on 3 dimensions. As our validation set, we use alldie from a randomly selected wafer from each of the 20 lots ofthe ratified fab (excluding the wafers used for training) andfrom each of the 20 lots of the undesired fab. The trainedSVMs are, then, used to individually decide whether eachdie in the validation set originated from the ratified fab ornot.

Figures 1a-c visualize the training and validation data onthe space of the two most discriminative raw measurements,on the two main components of the linearly transformedPCA space, and on the two components of the non-linearlytransformed t-SNE space, respectively. As may be observed,there is an almost complete population overlap in the firstcase, which is only slightly reduced after linear transforma-tion in the second case, because the variability of the datais non-linear. The non-linear transformation of the third

(a) Raw data (b) PCA

(c) t-SNE (d) One-class SVM results

Figure 1: Population overlap and single boundary classifica-tion accuracy in raw and transformed measurement spaces

case, however, performs significantly better in separatingthe two populations. While this is visualized only in a two-dimensional space, our extensive experimentation with mul-tiple dimensions has confirmed this observation, justifyingthe use of t-SNE as the method of choice for enhancing dis-crimination via dimensionality reduction in this context.

The results reported in the table of Figure 1d, which quan-tify the effectiveness of a single boundary established bytraining a one-class SVM in each of the three spaces men-tioned earlier, are also consistent with this observation. In-deed, attestation accuracy of a single IC in the raw dataspace is only 57.3%, barely higher than a coin-toss. Learn-ing the boundary in the 30-dimensional PCA space onlyslightly improves accuracy to 61%, while doing so in the3-dimensional t-SNE space boosts accuracy to 71.4%. Thisrather low accuracy is attributed to the highly discontinuousnature of the data in the projected space, which calls for aclustering-based classification approach, as we show next.

4.2 Learning only from ratified fabIn order to assess the effectiveness of AttestMe-I, we per-

form clustering and boundary identification on the t-SNEtransformed space of the training data, as detailed in Sec-tion 3.1. Then, for each IC in the validation set, we apply thedecision making step which examines whether its footprintin this space lies within the boundary of any of the clustersassigned to the ratified fab. Table 1a reports the attestationaccuracy for AttestMe-I, noting that we consider as positive,(P ), a chip originating from the ratified fab and as negative,(N), a chip originating from an undesired source. In thisconfusion matrix, True Positive Rate (TPR) denotes thepercentage of ICs that are correctly identified as originat-ing from the ratified fab, while True Negative Rate (TNR)refers to the percentage of ICs that are correctly labeled

Table 1: Single IC attestation results

(a) AttestMe-I (b) AttestMe-II

(a) AttestUs-I (b) AttestUs-II

Figure 2: Attestation results for various batch sizes

Figure 3: Histogram of p-values for AD test against theratified fab distribution for batches of 15 chips (AttestUs-I )

as originating from an undesired fab. False Positive Rate(FPR) and False Negative Rate (FNR) are defined simi-larly. As may be observed, the overall attestation accuracyis 85%, clearly outperforming the one-class SVM reportedin Figure 1d. This is expected due to the manifold natureof the t-SNE transformed data, which makes it difficult toseparate via a single boundary, as the SVM tries to do.

Effectiveness of AttestUs-I is assessed by first estimat-ing the performance parameter densities of the ratified fabthrough the training set. Then, for a batch of ICs originatingfrom the same fab, we measure the performance parametersfrom all ICs in the batch and we perform the AD member-ship test for each of the parameters, as detailed in Section3.2. In our experiment, we randomly draw batches of sizesin the range [15, 50] from the validation sets of the ratifiedand the undesired fab; this procedure is repeated 1000 timesfor each batch size. Figure 2a reports the AttestUs-I results.The horizontal axis denotes the batch size, while the verti-cal axis is the attestation error rate. As may be observed,this method is very successful in attesting the fab-of-originof a batch, with accuracy exceeding 96% for batch sizes ofas small as 15 ICs. The confusion matrix for this batch sizeis also provided in the figure.

To gain further insight, in Figure 3 we show the distribu-tion of p-values for a batch size of 15 ICs, where the x-axisrepresents the range of p-value and the y-axis shows thepercentage of 500 randomly selected batches which have ap-value within a given range. In the Anderson-Darling dis-tribution test, the null hypothesis is that the 15-dimensionalmeasurement vector of the 15 ICs in the batch comes froma specific population, which in our case is the distributionof the ratified fab. As shown in the left histogram, for thevast majority of the 500 samples from the ratified fab, thep-value is larger than 0.05, hence the null hypothesis is notrejected, i.e., these batches are correctly assumed to haveoriginated from the ratified fab. Conversely, as shown in theright histogram, for the vast majority of the 500 samplesfrom the undesired fab, the p-value is smaller than 0.05 andthe null hypothesis is rejected, i.e., these batches are cor-rectly assumed to have originated from the undesired fab.

4.3 Learning from all fabsIn order to quantify the accuracy of the proposed fab-of-

origin attestation solutions when test data from both the

(a) Samples from ratified fab (b) Samples from undesired fab

Figure 4: Histogram of p-values for AD test against theratified and the undesired fab distributions for batches of 15chips (AttestUs-II)

ratified and the undesired fab is available, we enhance thetraining set so that it contains data from both fabs. Specif-ically, in addition to all die from 5 randomly selected wafersin each of the 20 lots from the ratified fab, the new trainingset also includes all die from 5 randomly selected wafers ineach of the 20 lots from the undesired fab. The validation setremains unchanged, i.e., it contains all die from a randomlyselected wafer from each of the 20 lots of the ratified fab andfrom each of the 20 lots of the undesired fab (excluding thewafers used for training).

Evaluation of the AttestMe-II solution starts with train-ing a two-class classifier, in this case a five-layer DNN withtwo output neurons, using the training set, as explained inSection 3.3. The trained DNN is then applied to individu-ally classify each IC in the validation set as originating fromthe ratified or the undesired fab. AttestMe-II results aresummarized in Table 1b. As may be observed, the trainedDNN is able to accurately attest 96.5% of all chips and issignificantly better than the AttestMe-I approach. This isexpected, as we now have access to data from both fabs,which simplifies the process of learning the boundary thatseparates them, as compared to the case where training datais available only from the ratified fab.

Effectiveness of AttestUs-II requires estimation of the per-formance parameter densities for both the ratified and theundesired fab using the enhanced training set. Then, for abatch of devices from the same fab, we measure the perfor-mance parameters from all ICs in the batch. For each per-formance parameter, we perform the AD membership testagainst the densities of both fabs to compute the correspond-ing p-values, and we decide which fab the batch originatedfrom, as explained in Section 3.4. Once again, in our ex-periment we randomly draw batches of sizes in the range[15, 50] from the validation sets of the ratified and the un-desired fab, and repeat this procedure 1000 times for everybatch size. Figure 2b reports the AttestUs-II results, withthe x-axis denoting the batch size and the y-axis showing theattestation error. As may be observed, for a batch size ofas few as 25 ICs, the accuracy of this solution exceeds 99%,while for a batch size of 40 ICs, it achieves error-free attes-tation. A comparison to the curves in Figure 2a reveals thatavailability of the additional training information from theundesired fab enhances the accuracy of the membership testand reduces the error. As a point of reference, the confusionmatrix for the batch of size 15 is also provided.

Lastly, Figure 4 presents the histogram of p-values forbatches of 15 ICs. Figure 4a shows the p-values for 500batches originating from the ratified fab, wherein the topand bottom graphs compare these samples against the rat-ified and the undesired fab distributions, respectively. Evi-dently, for the vast majority of samples the null hypothesis isnot rejected for the ratified fab but is rejected for the unde-sired fab, hence these batches are correctly attested as orig-inating from the ratified fab. Conversely, Figure 4b demon-strates the same results for 500 batches originating from theundesired fab, in which case the results are reversed.

4.4 Future production attestation accuracyAs a final experiment, we evaluate the robustness of the

proposed solutions against fabrication process shifts. To doso, we use probe-test data from a new set of wafers from10 lots, which were fabricated in each of the two fabs a fewmonths after the wafers of our original dataset. We referto these new wafers as “future wafers”. Our training set re-mains the same, but our new validation set now comprisesall die from 20 randomly selected future wafers, equally dis-tributed across the 10 new lots from each of the two fabs.Table 2 compares the effectiveness of the AttestMe-II solu-tion on the original validation set, which comprises currentwafers (i.e., contemporary to those used for training) to theeffectiveness on the new validation set, which comprises fu-ture wafers. As may be observed, the trained DNN networkcontinues to attest ICs from future production with only avery slight reduction in accuracy. Similarly, Figure 5 com-pares the effectiveness of the AttestUs-II solution for ICs oncurrent and future wafers, where the x-axis is the batch sizeand the y-axis denotes the attestation error. Once again,the difference in the two scenarios is small and reduces asthe batch size increases. As an ancillary measure for main-taining robustness, the underlying trained models can beperiodically updated.

5. CONCLUSIONParametric measurements, such as the ones taken during

manufacturing testing, comprise valuable information whichreflects the interaction between the design of an IC and thefabrication process through which it was produced. In con-junction with machine learning methods, this informationmay be harnessed to provide effective solutions to numer-ous variants of the fab-of-origin attestation problem, withoutrequiring design modifications, custom processing steps, orspecialized characterization equipment. Four such solutionswere developed and evaluated using actual test data froma large number of ICs implementing an RF transceiver de-sign, which were fabricated in two geographically dispersedfoundries. Results indicate that the accuracy of these fab-of-origin attestation solutions reaches 96.5% when decidingwhether a single IC originated from a ratified fab or an un-known/undesired facility and 100% when collectively mak-ing the same decision for a batch of as few as 40 ICs.

It is worth noting that while precise cloning of an IC couldevade our methods, our study was performed on two fabsof the same manufacturer so it resembles the best cloneddevices one can build. Thus, we expect even higher attes-tation accuracy when the fabrication facilities are indepen-dent. Also, it is possible that changes in fabrication process,such as machine part replacements, software updates or newmaterial suppliers, may shift the process parameters and af-

Table 2: Comparison of AttestMe-II results for chips fromcurrent and future production

Figure 5: Comparison of AttestUs-II results for chips fromcurrent and future production

fect the accuracy of our models over time. Nevertheless, ourmethods were able to attest future productions with onlyminor accuracy reduction, demonstrating robustness of themodels to such changes. To reinforce robustness, our futureresearch focuses on attesting not only a specific fab but alsoa specific machine or material used in fabricating an IC.

6. REFERENCES[1] T. W. Anderson et al., “Asymptotic theory of certain “goodness

of fit” criteria based on stochastic processes,” The annals ofmathematical statistics, pp. 193–212, 1952.

[2] S. Bhunia et al., “Hardware trojan attacks: Threat analysis andcountermeasures,” Proceedings of the IEEE, vol. 102, no. 8, pp.1229–1247, 2014.

[3] G. Bloom et al., “Fab forensics: Increasing trust in ICfabrication,” in Proc. IEEE HST, 2010, pp. 99–105.

[4] DARPA. SB133-003: Electronic component fingerprinting todetermine manufacturing origin. [Online]. Available:http://www.acq.osd.mil/osbp/sbir/solicitations/sbir20133/darpa133.htm

[5] U. Guin et al., “Counterfeit integrated circuits: A rising threatin the global semiconductor supply chain,” Proceedings of theIEEE, vol. 102, no. 8, pp. 1207–1228, Aug 2014.

[6] G. E. Hinton et al., “A fast learning algorithm for deep beliefnets,” Neural computation, vol. 18, no. 7, pp. 1527–1554, 2006.

[7] D. E. Holcomb et al., “Power-up SRAM state as an identifyingfingerprint and source of true random numbers,” Trans.Computers, vol. 58, no. 9, pp. 1198–1210, 2009.

[8] K. Huang et al., “Recycled IC detection based on statisticalmethods,” Trans. Computer-Aided Design of IntegratedCircuits and Systems, vol. 34, no. 6, pp. 947–960, June 2015.

[9] I. Jolliffe, Principal component analysis. Wiley OnlineLibrary, 2002.

[10] L. M. Manevitz et al., “One-class SVMs for documentclassification,” the Journal of machine Learning research,vol. 2, pp. 139–154, 2002.

[11] M. Potkonjak et al., “Differential public physically unclonablefunctions: architecture and applications,” in Proc. ACM DAC,2011, pp. 242–247.

[12] B. W. Silverman, Density estimation for statistics and dataanalysis. CRC press, 1986, vol. 26.

[13] M. Tehranipoor et al., “A survey of hardware trojan taxonomyand detection,” IEEE Design & Test of Computers, vol. 27,no. 1, pp. 10–25, Jan 2010.

[14] R. Tibshirani et al., “Estimating the number of clusters in adata set via the gap statistic,” Journal of the Royal StatisticalSociety: Series B (Statistical Methodology), vol. 63, no. 2, pp.411–423, 2001.

[15] L. Van der Maaten et al., “Visualizing data using t-SNE,”Journal of Machine Learning Research, vol. 9, no. 2579-2605,p. 85, 2008.

[16] J. B. Wendt et al., “Techniques for foundry identification,” inProc. ACM DAC, 2014, pp. 1–6.